Technical Information
Modifies file system
Creates the following files
- %TEMP%\is-l340a.tmp\is-l99q6.tmp
- %ProgramFiles(x86)%\smart turn off\skins\is-jcfmd.tmp
- %ProgramFiles(x86)%\smart turn off\skins\is-a4lv6.tmp
- %ProgramFiles(x86)%\smart turn off\skins\is-cdvga.tmp
- %ProgramFiles(x86)%\smart turn off\skins\is-dra09.tmp
- %ProgramFiles(x86)%\smart turn off\skins\is-rqcjb.tmp
- %ProgramFiles(x86)%\smart turn off\skins\is-9f82v.tmp
- %ProgramFiles(x86)%\smart turn off\skins\is-nf227.tmp
- %ProgramFiles(x86)%\smart turn off\skins\is-3sukp.tmp
- %ProgramFiles(x86)%\smart turn off\skins\is-nar0s.tmp
- %ProgramFiles(x86)%\smart turn off\skins\is-jhk9k.tmp
- %ProgramFiles(x86)%\smart turn off\skins\is-3ejii.tmp
- %ProgramFiles(x86)%\smart turn off\skins\is-jbshi.tmp
- %ProgramFiles(x86)%\smart turn off\skins\is-7mg7o.tmp
- %ProgramFiles(x86)%\smart turn off\skins\is-r7suu.tmp
- %ProgramFiles(x86)%\smart turn off\skins\is-osns4.tmp
- %ProgramFiles(x86)%\smart turn off\skins\is-hbesb.tmp
- %ProgramFiles(x86)%\smart turn off\skins\is-3bs4m.tmp
- %ProgramFiles(x86)%\smart turn off\skins\is-9f9il.tmp
- %ProgramFiles(x86)%\smart turn off\skins\is-njcdl.tmp
- %ProgramFiles(x86)%\smart turn off\skins\is-l40ut.tmp
- %ProgramFiles(x86)%\smart turn off\skins\is-fmf8f.tmp
- %ProgramFiles(x86)%\smart turn off\skins\is-6a4of.tmp
- %ProgramFiles(x86)%\smart turn off\skins\is-29u9r.tmp
- %ProgramFiles(x86)%\smart turn off\skins\is-85c6v.tmp
- %ProgramFiles(x86)%\smart turn off\skins\is-vb0nq.tmp
- %ProgramFiles(x86)%\smart turn off\skins\is-msq87.tmp
- %ProgramFiles(x86)%\smart turn off\is-i607h.tmp
- %ProgramFiles(x86)%\smart turn off\is-tq66a.tmp
- %ProgramFiles(x86)%\smart turn off\unins000.dat
- %ProgramFiles(x86)%\smart turn off\skins\is-275i9.tmp
- %ProgramFiles(x86)%\smart turn off\smartturnoff.exe
- %ProgramFiles(x86)%\smart turn off\skins\is-fubm4.tmp
- %ProgramFiles(x86)%\smart turn off\skins\is-1c3l9.tmp
- %TEMP%\is-gth7d.tmp\_isetup\_regdll.tmp
- %TEMP%\is-gth7d.tmp\_isetup\_setup64.tmp
- %TEMP%\is-gth7d.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-gth7d.tmp\_isetup\_iscrypt.dll
- %ProgramFiles(x86)%\smart turn off\is-undrp.tmp
- %ProgramFiles(x86)%\smart turn off\is-7mo4t.tmp
- %ProgramFiles(x86)%\smart turn off\is-qjr2l.tmp
- %ProgramFiles(x86)%\smart turn off\is-qvv8m.tmp
- %ProgramFiles(x86)%\smart turn off\is-0r7t6.tmp
- %ProgramFiles(x86)%\smart turn off\is-vqtiq.tmp
- %ProgramFiles(x86)%\smart turn off\is-h56b6.tmp
- %ProgramFiles(x86)%\smart turn off\skins\is-4882e.tmp
- %ProgramFiles(x86)%\smart turn off\skins\is-pb68q.tmp
- %ProgramFiles(x86)%\smart turn off\skins\is-qmh41.tmp
- %ProgramFiles(x86)%\smart turn off\skins\is-s1ikc.tmp
- %ProgramFiles(x86)%\smart turn off\skins\is-v4qfb.tmp
- %ProgramFiles(x86)%\smart turn off\skins\is-q2b4f.tmp
- %ProgramFiles(x86)%\smart turn off\skins\is-lellb.tmp
- %ProgramFiles(x86)%\smart turn off\skins\is-on6dv.tmp
- %ProgramFiles(x86)%\smart turn off\skins\is-h4eu8.tmp
- %ProgramFiles(x86)%\smart turn off\skins\is-hh8pt.tmp
- %ProgramFiles(x86)%\smart turn off\skins\is-gnung.tmp
- %ProgramFiles(x86)%\smart turn off\skins\is-qlrbm.tmp
- %ProgramFiles(x86)%\smart turn off\skins\is-51thr.tmp
- %ProgramFiles(x86)%\smart turn off\skins\is-sofmr.tmp
- %ProgramFiles(x86)%\smart turn off\skins\is-nqmf7.tmp
- %ProgramFiles(x86)%\smart turn off\skins\is-l3s59.tmp
- %ProgramFiles(x86)%\smart turn off\skins\is-pck0s.tmp
- %ProgramFiles(x86)%\smart turn off\skins\is-4jsd2.tmp
- %ProgramFiles(x86)%\smart turn off\skins\is-4s2mh.tmp
- %TEMP%\version.txt
Moves the following files
- from %ProgramFiles(x86)%\smart turn off\is-undrp.tmp to %ProgramFiles(x86)%\smart turn off\unins000.exe
- from %ProgramFiles(x86)%\smart turn off\skins\is-a4lv6.tmp to %ProgramFiles(x86)%\smart turn off\skins\nextalpha.asz
- from %ProgramFiles(x86)%\smart turn off\skins\is-cdvga.tmp to %ProgramFiles(x86)%\smart turn off\skins\nextalpha2.asz
- from %ProgramFiles(x86)%\smart turn off\skins\is-dra09.tmp to %ProgramFiles(x86)%\smart turn off\skins\office12style.asz
- from %ProgramFiles(x86)%\smart turn off\skins\is-rqcjb.tmp to %ProgramFiles(x86)%\smart turn off\skins\office2003.asz
- from %ProgramFiles(x86)%\smart turn off\skins\is-9f82v.tmp to %ProgramFiles(x86)%\smart turn off\skins\office2007 black.asz
- from %ProgramFiles(x86)%\smart turn off\skins\is-nf227.tmp to %ProgramFiles(x86)%\smart turn off\skins\office2007 blue.asz
- from %ProgramFiles(x86)%\smart turn off\skins\is-3sukp.tmp to %ProgramFiles(x86)%\smart turn off\skins\opus.asz
- from %ProgramFiles(x86)%\smart turn off\skins\is-nar0s.tmp to %ProgramFiles(x86)%\smart turn off\skins\pulsar.asz
- from %ProgramFiles(x86)%\smart turn off\skins\is-jhk9k.tmp to %ProgramFiles(x86)%\smart turn off\skins\retro.asz
- from %ProgramFiles(x86)%\smart turn off\skins\is-3ejii.tmp to %ProgramFiles(x86)%\smart turn off\skins\rhombus.asz
- from %ProgramFiles(x86)%\smart turn off\skins\is-jbshi.tmp to %ProgramFiles(x86)%\smart turn off\skins\sand.asz
- from %ProgramFiles(x86)%\smart turn off\skins\is-7mg7o.tmp to %ProgramFiles(x86)%\smart turn off\skins\soapsky - blue.asz
- from %ProgramFiles(x86)%\smart turn off\skins\is-r7suu.tmp to %ProgramFiles(x86)%\smart turn off\skins\soapsky - lime.asz
- from %ProgramFiles(x86)%\smart turn off\skins\is-osns4.tmp to %ProgramFiles(x86)%\smart turn off\skins\steam.asz
- from %ProgramFiles(x86)%\smart turn off\skins\is-hbesb.tmp to %ProgramFiles(x86)%\smart turn off\skins\terminal4bit.asz
- from %ProgramFiles(x86)%\smart turn off\skins\is-3bs4m.tmp to %ProgramFiles(x86)%\smart turn off\skins\thefrog.asz
- from %ProgramFiles(x86)%\smart turn off\skins\is-9f9il.tmp to %ProgramFiles(x86)%\smart turn off\skins\vista.asz
- from %ProgramFiles(x86)%\smart turn off\skins\is-njcdl.tmp to %ProgramFiles(x86)%\smart turn off\skins\winter2003.asz
- from %ProgramFiles(x86)%\smart turn off\skins\is-l40ut.tmp to %ProgramFiles(x86)%\smart turn off\skins\wlm.asz
- from %ProgramFiles(x86)%\smart turn off\skins\is-fmf8f.tmp to %ProgramFiles(x86)%\smart turn off\skins\wmp 2008.asz
- from %ProgramFiles(x86)%\smart turn off\skins\is-6a4of.tmp to %ProgramFiles(x86)%\smart turn off\skins\wmp11.asz
- from %ProgramFiles(x86)%\smart turn off\skins\is-29u9r.tmp to %ProgramFiles(x86)%\smart turn off\skins\wood.asz
- from %ProgramFiles(x86)%\smart turn off\skins\is-85c6v.tmp to %ProgramFiles(x86)%\smart turn off\skins\xpluna.asz
- from %ProgramFiles(x86)%\smart turn off\skins\is-vb0nq.tmp to %ProgramFiles(x86)%\smart turn off\skins\xpsilver.asz
- from %ProgramFiles(x86)%\smart turn off\skins\is-msq87.tmp to %ProgramFiles(x86)%\smart turn off\skins\skins.txt
- from %ProgramFiles(x86)%\smart turn off\skins\is-jcfmd.tmp to %ProgramFiles(x86)%\smart turn off\skins\neutral4.asz
- from %ProgramFiles(x86)%\smart turn off\is-i607h.tmp to %ProgramFiles(x86)%\smart turn off\info.txt
- from %ProgramFiles(x86)%\smart turn off\skins\is-275i9.tmp to %ProgramFiles(x86)%\smart turn off\skins\neutral3.asz
- from %ProgramFiles(x86)%\smart turn off\skins\is-4s2mh.tmp to %ProgramFiles(x86)%\smart turn off\skins\neutral.asz
- from %ProgramFiles(x86)%\smart turn off\is-7mo4t.tmp to %ProgramFiles(x86)%\smart turn off\smartturnoff.exe
- from %ProgramFiles(x86)%\smart turn off\is-qjr2l.tmp to %ProgramFiles(x86)%\smart turn off\smtimer.exe
- from %ProgramFiles(x86)%\smart turn off\is-qvv8m.tmp to %ProgramFiles(x86)%\smart turn off\smlooka.exe
- from %ProgramFiles(x86)%\smart turn off\is-0r7t6.tmp to %ProgramFiles(x86)%\smart turn off\turbosearch.exe
- from %ProgramFiles(x86)%\smart turn off\is-vqtiq.tmp to %ProgramFiles(x86)%\smart turn off\wizard.dll
- from %ProgramFiles(x86)%\smart turn off\is-h56b6.tmp to %ProgramFiles(x86)%\smart turn off\sm_uninst.exe
- from %ProgramFiles(x86)%\smart turn off\skins\is-4882e.tmp to %ProgramFiles(x86)%\smart turn off\skins\beijing.asz
- from %ProgramFiles(x86)%\smart turn off\skins\is-pb68q.tmp to %ProgramFiles(x86)%\smart turn off\skins\bluegauze.asz
- from %ProgramFiles(x86)%\smart turn off\skins\is-qmh41.tmp to %ProgramFiles(x86)%\smart turn off\skins\blueglass.asz
- from %ProgramFiles(x86)%\smart turn off\skins\is-s1ikc.tmp to %ProgramFiles(x86)%\smart turn off\skins\blueice.asz
- from %ProgramFiles(x86)%\smart turn off\skins\is-v4qfb.tmp to %ProgramFiles(x86)%\smart turn off\skins\blueplastic.asz
- from %ProgramFiles(x86)%\smart turn off\skins\is-q2b4f.tmp to %ProgramFiles(x86)%\smart turn off\skins\cappuccino.asz
- from %ProgramFiles(x86)%\smart turn off\skins\is-lellb.tmp to %ProgramFiles(x86)%\smart turn off\skins\cold.asz
- from %ProgramFiles(x86)%\smart turn off\skins\is-on6dv.tmp to %ProgramFiles(x86)%\smart turn off\skins\darkglass.asz
- from %ProgramFiles(x86)%\smart turn off\skins\is-h4eu8.tmp to %ProgramFiles(x86)%\smart turn off\skins\desert.asz
- from %ProgramFiles(x86)%\smart turn off\skins\is-hh8pt.tmp to %ProgramFiles(x86)%\smart turn off\skins\falloutstyle.asz
- from %ProgramFiles(x86)%\smart turn off\skins\is-gnung.tmp to %ProgramFiles(x86)%\smart turn off\skins\golden.asz
- from %ProgramFiles(x86)%\smart turn off\skins\is-qlrbm.tmp to %ProgramFiles(x86)%\smart turn off\skins\grayplastic.asz
- from %ProgramFiles(x86)%\smart turn off\skins\is-51thr.tmp to %ProgramFiles(x86)%\smart turn off\skins\heroesstyle.asz
- from %ProgramFiles(x86)%\smart turn off\skins\is-sofmr.tmp to %ProgramFiles(x86)%\smart turn off\skins\ledenets.asz
- from %ProgramFiles(x86)%\smart turn off\skins\is-nqmf7.tmp to %ProgramFiles(x86)%\smart turn off\skins\likeoperastyle.asz
- from %ProgramFiles(x86)%\smart turn off\skins\is-l3s59.tmp to %ProgramFiles(x86)%\smart turn off\skins\longhorn.asz
- from %ProgramFiles(x86)%\smart turn off\skins\is-pck0s.tmp to %ProgramFiles(x86)%\smart turn off\skins\macmetal.asz
- from %ProgramFiles(x86)%\smart turn off\skins\is-4jsd2.tmp to %ProgramFiles(x86)%\smart turn off\skins\macos.asz
- from %ProgramFiles(x86)%\smart turn off\skins\is-1c3l9.tmp to %ProgramFiles(x86)%\smart turn off\skins\macos2.asz
- from %ProgramFiles(x86)%\smart turn off\skins\is-fubm4.tmp to %ProgramFiles(x86)%\smart turn off\skins\neutral2.asz
- from %ProgramFiles(x86)%\smart turn off\is-tq66a.tmp to %ProgramFiles(x86)%\smart turn off\help.chm
Network activity
Connects to
- 'jo####rdmust.sbs':80
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?64########
HTTP POST requests
- http://jo####rdmust.sbs/new/net_api
UDP
- DNS ASK jo####rdmust.sbs
Miscellaneous
Searches for the following windows
- ClassName: 'WindowsTurnOffMaster221' WindowName: ''
Creates and executes the following
- '%TEMP%\is-l340a.tmp\is-l99q6.tmp' /SL4 $B0218 "<Full path to file>" 7557281 52736
- '%ProgramFiles(x86)%\smart turn off\smartturnoff.exe'
- '%ProgramFiles(x86)%\smart turn off\smartturnoff.exe' 40cca973d20410255e00f43fcaf8fd3f
Executes the following
- '%WINDIR%\syswow64\net.exe' helpmsg 52
- '%WINDIR%\syswow64\net1.exe' helpmsg 52
- '%WINDIR%\syswow64\net.exe' pause SmartTurn0218
- '%WINDIR%\syswow64\net1.exe' pause SmartTurn0218